[Scummvm-git-logs] scummvm master -> 360e1e97c9c5452431170d2724b3840b817aa5f8

[bgK]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
360e1e97c9 IMAGE: Check the output surface bounds when writing QT encoded PICT images


Commit: 360e1e97c9c5452431170d2724b3840b817aa5f8
    https://github.com/scummvm/scummvm/commit/360e1e97c9c5452431170d2724b3840b817aa5f8
Author: Bastien Bouclet (bastien.bouclet at gmail.com)
Date: 2018-09-14T19:54:52+02:00

Commit Message:
IMAGE: Check the output surface bounds when writing QT encoded PICT images

Changed paths:
    image/pict.cpp


diff --git a/image/pict.cpp b/image/pict.cpp
index 4f4f039..1a1d03d 100644
--- a/image/pict.cpp
+++ b/image/pict.cpp
@@ -577,9 +577,14 @@ void PICTDecoder::decodeCompressedQuickTime(Common::SeekableReadStream &stream)
 		_outputSurface = new Graphics::Surface();
 		_outputSurface->create(_imageRect.width(), _imageRect.height(), surface->format);
 	}
+	assert(_outputSurface->format == surface->format);
 
-	for (uint16 y = 0; y < surface->h; y++)
-		memcpy(_outputSurface->getBasePtr(0 + xOffset, y + yOffset), surface->getBasePtr(0, y), surface->w * surface->format.bytesPerPixel);
+	Common::Rect outputRect(surface->w, surface->h);
+	outputRect.translate(xOffset, yOffset);
+	outputRect.clip(_imageRect);
+
+	for (uint16 y = 0; y < outputRect.height(); y++)
+		memcpy(_outputSurface->getBasePtr(outputRect.left, y + outputRect.top), surface->getBasePtr(0, y), outputRect.width() * surface->format.bytesPerPixel);
 
 	stream.seek(startPos + dataSize);
 	delete codec;